EC-Council's incident handling credential — the advanced, capstone cert in their Incident Handling & Response track, after CND and CEH.
ECIH certifies the full incident response lifecycle across every major incident type: malware, email, network, application, cloud, insider threat, and endpoint incidents, each covered through preparation, detection, containment, eradication, recovery, and best practices. It's the credential for the analyst who owns incident response itself — not just detection or forensics in isolation — and it pairs naturally with CND (defense) and CHFI (post-incident forensics) for a complete blue-team skill set.
Source: U.S. Bureau of Labor Statistics, Information Security Analysts (incident response track) · May 2024 wage data, 2024–2034 growth projection
Self-paced access, AI Coach on every lesson, full-length practice exams, and a free course retake if you complete the readiness gate and still don't pass your exam on the first attempt. Exam registration and voucher are purchased separately, directly through the certifying body.
See the full curriculum100% self-paced online — study on your schedule, no bootcamp seat to book.
Training a whole team on ECIH? Fund a Training Bank account for any amount, then assign any course to any employee — self-serve, published discount tiers, no sales call.
Set up your team account
